A computer network is a collection of interconnected computing devices that exchange data and share resources. In a packet-based network the computing devices communicate data by dividing the data into small blocks called packets. The packets are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
Network tunnels, such as virtual private networks (VPNs), are often used to securely share data over a public network infrastructure, such as the Internet. For example, an enterprise that includes multiple geographically separated sites, each site including one or more computing devices, may establish a VPN to allow the computing devices to securely communicate through the Internet or another public network infrastructure.
A number of communication protocols have been developed for establishing a VPN. In general, these protocols allow network devices to establish the VPN as one or more secure data flows across the public network infrastructure. For example, Internet Protocol Security (IPSec) protocols and Secure Sockets Layer (SSL) protocols make use of cryptographic technology to establish network tunnels. These tunnels allow packets conforming to other network protocols, such as Internet Protocol (IP) packets, to be encapsulated within encrypted packet streams flowing between the sites.
SSL VPN implementations tunnel IP packets on top of a Layer 4 connection oriented protocol, e.g., Transmission Control Protocol (TCP). The TCP inherently introduces latency and performance problems within the SSL VPN tunnel. However, firewalls typically recognize SSL packets and allow the SSL VPN to work through the firewalls. Moreover, SSL VPNs can also work through proxies.
In contrast, IPSec VPN implementations tunnel encrypted IP packets, i.e., Encapsulation Security Payload (ESP) packets, on top of a connection-less protocol, e.g., IP or User Datagram Protocol (UDP). IP and UDP do not suffer the performance drawbacks of TCP. However, IPSec VPNs cannot work though some firewalls, which may cause the firewalls to drop IPSec packets. Additionally, IPSec VPNs cannot work in restricted internet access scenarios where internet access is only available through a proxy. For these and other reasons, selection of a tunneling protocol for use with a VPN can be a challenging task.